aws-lambda-cross-account-code

Cross-account principal that can run code in a function enters this account.

derived aws emits CanEnterAccount

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

emit

source type	`Identity`
target type	`Account`
source	`?external`
target	`<account of ?function>`
permissions	`lambda:UpdateFunctionCode` `lambda:InvokeFunction?`
conditions	`resource_policy` `trigger_exists`
state logic	if resource_policy grants the cross-account code/invoke action AND (matched(optional[0]) or trigger_exists(?function)): ACTIVE else CONDITIONAL(resource_policy, trigger_exists)

source type

Identity

target type

Account

source

?external

target

<account of ?function>

permissions

lambda:UpdateFunctionCode lambda:InvokeFunction?

conditions

resource_policy trigger_exists

state logic

if resource_policy grants the cross-account code/invoke action AND (matched(optional[0]) or trigger_exists(?function)): ACTIVE else CONDITIONAL(resource_policy, trigger_exists)

Narrative

{external.name} (account {external.account}) can run code in {function.name} and obtain execution-role {role.name}, gaining a foothold in account {function.account}.

Raw rule rules/derived/aws/lambda.yaml

id: aws-lambda-cross-account-code
emits: CanEnterAccount
description: Cross-account principal that can run code in a function enters this account.
match:
- - external: null
  - CanModifyCode
  - function: null
- - function: null
  - ExecutesAs
  - role: null
where:
- ?external.account != ?function.account
- resource-based policy or cross-account identity grant permits the code/invoke action
optional:
- - external: null
  - CanInvoke
  - function: null
emit:
  source_type: Identity
  target_type: Account
  source: ?external
  target: <account of ?function>
  permissions:
  - lambda:UpdateFunctionCode
  - lambda:InvokeFunction?
  conditions:
  - resource_policy
  - trigger_exists
  state_logic: 'if resource_policy grants the cross-account code/invoke action AND (matched(optional[0])
    or trigger_exists(?function)): ACTIVE else CONDITIONAL(resource_policy, trigger_exists)'
  derived_from:
  - <CanModifyCode edge_id>
  - <ExecutesAs edge_id>
  false_positive_note: "Requires the cross-account action to be actually granted (resource policy + the\
    \ caller's identity policy for cross-account invoke). SourceArn/SourceAccount scoping on AddPermission\
    \ narrows who qualifies \u2014 honor it."
  narrative: '{external.name} (account {external.account}) can run code in {function.name} and obtain
    execution-role {role.name}, gaining a foothold in account {function.account}.'